A slightly different phishing scam that I haven’t seen before, although I have seen lots of BT scams and phishing attempts. I have only seen this one example today, but if “normal ” behaviour applies then the reference numbers will be random and different in each email. I have obviously removed the recipients name and any other identifiable details.
From: British Telecom <test@DW-DEV.COM>
Date: Wed 08/02/2017 11:31
Subject: Your monthly payment #638721822 was recently declined
Your monthly payment was recently declined. The decline could be due to insufficient funds, card expired, etc. Since you haven’t provided us new billing information yet, we thought we’d remind you to please provide us with updated billing information to avoid any billing problems with your account.
Review account information
Are you making the most of what you get with BT – like secure online storage with BT Cloud? Head to My BT to check your settings.
Add Extras Thanks, Libby Barr Managing Director, Customer Care
Keep up-to-date with any changes to your packages or products at bt.com/updates
The links in the email go to http://www.mvtksa.com/oldbury/tvr207.php which redirects to http://www.muhfar.com/bt/login.php?ssid=3eae62bba9ddf64f69d49dc48e2dd214&PHPSESSID=b51398cbeea34817d45a7f198b928124
where you see a webpage looking like the genuine BT page ( if you don’t pay attention to the wrong address in the URL bar